You may have heard reports of Pegasus spyware infecting the phones of politicians, journalists and activists. Mobile security is more important than ever, but it’s a daunting task. Dr. Seungwon Shin, Vice President and Head of Security Team, Mobile eXperience Business at Samsung Electronics, wrote an op-ed detailing how Samsung Galaxy devices are protected against new threats.
Dr. Shin led security innovations in the Galaxy ecosystem, including the development of secure access points and the Samsung Knox Vault. He is a member of the INTERPOL DarkNet Working Group as well as Chairman of the FIDO Korea Working Group.
Dr. Seungwon Shin is Vice President and Head of Security Team, MX Business at Samsung Electronics
“Now you probably think you’re fine, because you’re reasonable. But there are many misconceptions about security,” writes Dr. Shin. An example he gives is not opening suspicious attachments – this is not enough as there are so-called “zero-click” attacks.
That’s how Pegasus worked, exploiting a weakness in a popular messaging system. “Zero-click” means that simply receiving the malicious message is enough for the security of the phone to be compromised.
Dr Shin touts the open source nature of Android as an advantage – it allows anyone to inspect code and discover vulnerabilities. Samsung runs the Mobile Security Rewards program, which has awarded more than $3.5 million in rewards to academics and hackers who have helped improve Android security.
The company also runs an incident response and management team, which monitors emerging threats and uses machine learning to predict future threats.
Software is not enough, however, Samsung also builds security into the hardware of Galaxy devices. The most recent development on this front is the Knox Vault, which combines a secure processor with a secure memory chip, which separates sensitive information from the rest of the device.
This allows Samsung Knox to lock down services like Samsung Pay and Samsung Pass as soon as it detects a major security risk. The secure memory chip contains PIN codes, passwords, biometric data, digital certificates, cryptographic keys, etc.